@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go/backend/internal/helper/write_files_linux.go

@@ -1,205 +0,0 @@
-package helper
-
-import (
-	"context"
-	"errors"
-	"golang.org/x/sys/unix"
-	"os"
-	"strconv"
-)
-
-// Anonymous staging is created by the actor in the destination directory, so
-// filesystem default ACL inheritance applies. No attacker-controlled stage name
-// is ever linked, renamed or unlinked. Missing O_TMPFILE / fixed-FD link support
-// refuses publish rather than falling back to check-then-rename.
-type actorFileWriter struct {
-	parent                    *readOnlyObject
-	file                      *os.File
-	before                    unix.Stat_t
-	work                      writeWork
-	acl                       readOnlyACL
-	receipt                   MutationReceipt
-	failed, attempted, closed bool
-	syncParent                func() error // fixed parent.Sync; fault injection only in tests
-}
-
-func openActorWriteTransfer(ctx context.Context, pin *pinnedReadOnlyRoot, w writeWork, acl readOnlyACL) (*actorFileWriter, Code) {
-	if c := w.validate(); c != "" {
-		return nil, c
-	}
-	if acl == nil {
-		return nil, ErrUnsupported
-	}
-	parentWork := readOnlyWork{RootPath: w.RootPath, Action: ActionStat, Segments: w.Segments[:len(w.Segments)-1]}
-	p, c := resolveReadOnly(ctx, pin, parentWork)
-	if c != "" {
-		return nil, c
-	}
-	ok := false
-	defer func() {
-		if !ok {
-			p.Close()
-		}
-	}()
-	if p.before.Mode&unix.S_IFMT != unix.S_IFDIR {
-		return nil, ErrDenied
-	}
-	for _, fd := range []int{int(p.nodes[p.root].file.Fd()), int(p.data.Fd())} {
-		if c := nativeObservationCode(ctx, acl.Authorize(ctx, w.Action, fd)); c != "" {
-			return nil, c
-		}
-	}
-	if c := p.check(); c != "" {
-		return nil, c
-	}
-	flags := unix.O_WRONLY | unix.O_CLOEXEC | unix.O_NOFOLLOW | unix.O_NONBLOCK
-	name := w.Segments[len(w.Segments)-1]
-	if w.Staged {
-		flags |= unix.O_TMPFILE
-		name = "."
-	} else {
-		flags |= unix.O_CREAT | unix.O_EXCL
-	}
-	fd, e := unix.Openat(int(p.data.Fd()), name, flags, 0666)
-	if e != nil {
-		if w.Staged && (errors.Is(e, unix.EOPNOTSUPP) || errors.Is(e, unix.EINVAL) || errors.Is(e, unix.EISDIR)) {
-			return nil, ErrUnsupported
-		}
-		if errors.Is(e, unix.EEXIST) {
-			return nil, ErrDenied
-		}
-		return nil, readOnlyError(e)
-	}
-	x := &actorFileWriter{parent: p, file: os.NewFile(uintptr(fd), "actor-write"), work: w, acl: acl, receipt: MutationReceipt{Created: true}, syncParent: p.data.Sync}
-	// A successful exclusive open is already a visible effect, even if following
-	// checks fail. Return the owned FD and partial receipt; never unlink its name.
-	ok = true
-	if unix.Fstat(fd, &x.before) != nil || x.before.Mode&unix.S_IFMT != unix.S_IFREG || x.before.Dev != p.before.Dev {
-		x.failed = true
-		return x, ErrPartial
-	}
-	if c := x.check(ctx); c != "" {
-		x.failed = true
-		return x, ErrPartial
-	}
-	return x, ""
-}
-func (x *actorFileWriter) Receipt() MutationReceipt       { return x.receipt }
-func (x *actorFileWriter) check(ctx context.Context) Code { return x.checkAction(ctx, x.work.Action) }
-func (x *actorFileWriter) checkAction(ctx context.Context, action Action) Code {
-	if x.closed {
-		return ErrCanceled
-	}
-	if c := nativeContextCode(ctx); c != "" {
-		return c
-	}
-	if c := x.parent.check(); c != "" {
-		return c
-	}
-	var st unix.Stat_t
-	if unix.Fstat(int(x.file.Fd()), &st) != nil || !sameReadOnlyObject(st, x.before) || st.Size != int64(x.receipt.BytesWritten) {
-		return ErrStale
-	}
-	links := uint64(1)
-	if x.work.Staged && !x.receipt.Published {
-		links = 0
-	}
-	if uint64(st.Nlink) != links {
-		return ErrDenied
-	}
-	if !x.work.Staged || x.receipt.Published {
-		var named unix.Stat_t
-		if unix.Fstatat(int(x.parent.data.Fd()), x.work.Segments[len(x.work.Segments)-1], &named, unix.AT_SYMLINK_NOFOLLOW) != nil || !sameReadOnlyObject(st, named) {
-			return ErrStale
-		}
-	}
-	for _, fd := range []int{int(x.parent.nodes[x.parent.root].file.Fd()), int(x.parent.data.Fd()), int(x.file.Fd())} {
-		if c := nativeObservationCode(ctx, x.acl.Authorize(ctx, action, fd)); c != "" {
-			return c
-		}
-	}
-	return nativeContextCode(ctx)
-}
-func (x *actorFileWriter) WriteChunk(ctx context.Context, b []byte) (MutationReceipt, Code) {
-	if x.failed || x.attempted || x.closed {
-		return x.receipt, ErrPartial
-	}
-	if len(b) == 0 || len(b) > MaxChunkBytes || uint64(len(b)) > x.work.MaxBytes-x.receipt.BytesWritten {
-		return x.receipt, ErrLimit
-	}
-	if c := x.check(ctx); c != "" {
-		x.failed = true
-		return x.receipt, ErrPartial
-	}
-	n, e := x.file.Write(b)
-	x.receipt.BytesWritten += uint64(n)
-	if e != nil || n != len(b) {
-		x.failed = true
-		return x.receipt, ErrPartial
-	}
-	if c := x.check(ctx); c != "" {
-		x.failed = true
-		return x.receipt, ErrPartial
-	}
-	return x.receipt, ""
-}
-func (x *actorFileWriter) Commit(ctx context.Context) (MutationReceipt, Code) {
-	if x.attempted {
-		return x.receipt, ErrReplay
-	}
-	x.attempted = true
-	if x.failed || x.closed {
-		return x.receipt, ErrPartial
-	}
-	action := x.work.Action
-	if x.work.Staged {
-		action = ActionPublish
-	}
-	if c := x.checkAction(ctx, action); c != "" {
-		return x.receipt, c
-	}
-	if !x.work.Staged && x.receipt.BytesWritten != x.work.MaxBytes {
-		return x.receipt, ErrPartial
-	}
-	if e := x.file.Sync(); e != nil {
-		return x.receipt, ErrPartial
-	}
-	if c := x.checkAction(ctx, action); c != "" {
-		return x.receipt, c
-	}
-	if x.work.Staged {
-		// Atomic no-replace on kernels without renameat2. O_TMPFILE has no source
-		// name; linkat follows only this actor's live descriptor alias. No unlink of
-		// the destination is ever performed, including failure/foreign replacement.
-		e := unix.Linkat(unix.AT_FDCWD, "/proc/self/fd/"+strconv.Itoa(int(x.file.Fd())), int(x.parent.data.Fd()), x.work.Segments[len(x.work.Segments)-1], unix.AT_SYMLINK_FOLLOW)
-		if e != nil {
-			return x.receipt, publishLinkError(e)
-		}
-	}
-	x.receipt.Published = true
-	if c := x.checkAction(ctx, action); c != "" {
-		return x.receipt, ErrCommitUncertain
-	}
-	if e := x.syncParent(); e != nil {
-		return x.receipt, ErrCommitUncertain
-	}
-	if c := x.checkAction(ctx, action); c != "" {
-		return x.receipt, ErrCommitUncertain
-	}
-	x.receipt.Committed = true
-	return x.receipt, ""
-}
-func publishLinkError(err error) Code {
-	if errors.Is(err, unix.EEXIST) || errors.Is(err, unix.EACCES) {
-		return ErrDenied
-	}
-	return ErrUnsupported
-}
-func (x *actorFileWriter) Close() {
-	if x.closed {
-		return
-	}
-	x.closed = true
-	x.file.Close()
-	x.parent.Close()
-}

package/templates/native-go/backend/internal/helper/write_files_linux_test.go

@@ -1,225 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"golang.org/x/sys/unix"
-	"os"
-	"testing"
-)
-
-func TestPublishLinkError(t *testing.T) {
-	for _, tc := range []struct {
-		err  error
-		want Code
-	}{
-		{unix.EACCES, ErrDenied},
-		{unix.EEXIST, ErrDenied},
-		{unix.EPERM, ErrUnsupported},
-		{unix.ENOSYS, ErrUnsupported},
-		{unix.EOPNOTSUPP, ErrUnsupported},
-		{unix.EINVAL, ErrUnsupported},
-		{unix.ENOENT, ErrUnsupported},
-		{unix.EXDEV, ErrUnsupported},
-		{unix.EROFS, ErrUnsupported},
-		{unix.EIO, ErrUnsupported},
-	} {
-		t.Run(tc.err.Error(), func(t *testing.T) {
-			for _, err := range []error{tc.err, &os.LinkError{Op: "linkat", Old: "fixed-fd", New: "destination", Err: tc.err}} {
-				if got := publishLinkError(err); got != tc.want {
-					t.Errorf("publishLinkError(%v) = %s, want %s", err, got, tc.want)
-				}
-			}
-		})
-	}
-}
-
-func TestWriteExclusivePartialAndNoForeignUnlink(t *testing.T) {
-	pin, root := readOnlyFixture(t)
-	w := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"new"}, MaxBytes: 10}
-	x, c := openActorWriteTransfer(context.Background(), pin, w, fixtureReadOnlyACL{})
-	if c != "" {
-		t.Fatal(c)
-	}
-	defer x.Close()
-	r, c := x.WriteChunk(context.Background(), []byte("abc"))
-	if c != "" || r.BytesWritten != 3 || r.Committed {
-		t.Fatal(r, c)
-	}
-	if _, c := openActorWriteTransfer(context.Background(), pin, w, fixtureReadOnlyACL{}); c == "" {
-		t.Fatal("duplicate create")
-	}
-	if e := os.Rename(root+"/new", root+"/moved"); e != nil {
-		t.Fatal(e)
-	}
-	os.WriteFile(root+"/new", []byte("foreign"), 0644)
-	r, c = x.WriteChunk(context.Background(), []byte("def"))
-	if c != ErrPartial || r.BytesWritten != 3 {
-		t.Fatal(r, c)
-	}
-	x.Close()
-	b, _ := os.ReadFile(root + "/new")
-	if string(b) != "foreign" {
-		t.Fatal("foreign path damaged")
-	}
-}
-func TestWriteStageFixedFDNoOverwriteAndCommitGap(t *testing.T) {
-	for _, kind := range []string{"success", "exists", "fsync-gap", "acl", "cancel"} {
-		t.Run(kind, func(t *testing.T) {
-			pin, root := readOnlyFixture(t)
-			w := writeWork{RootPath: root, Action: ActionWriteStream, Segments: []string{"published"}, MaxBytes: MaxTransferBytes, Staged: true}
-			acl := &writeTestACL{}
-			x, c := openActorWriteTransfer(context.Background(), pin, w, acl)
-			if c != "" {
-				t.Fatal(c)
-			}
-			defer x.Close()
-			if _, e := os.Stat(root + "/published"); !os.IsNotExist(e) {
-				t.Fatal("stage visible at destination")
-			}
-			for n := 0; n < 32; n++ {
-				r, c := x.WriteChunk(context.Background(), bytes.Repeat([]byte("x"), MaxChunkBytes))
-				if c != "" || r.BytesWritten != uint64((n+1)*MaxChunkBytes) {
-					t.Fatal(r, c)
-				}
-			}
-			switch kind {
-			case "exists":
-				os.WriteFile(root+"/published", []byte("foreign"), 0644)
-			case "fsync-gap":
-				x.syncParent = func() error { return unix.EIO }
-			case "acl":
-				acl.deny = true
-			}
-			ctx := context.Background()
-			if kind == "cancel" {
-				cancelCtx, cancel := context.WithCancel(ctx)
-				cancel()
-				ctx = cancelCtx
-			}
-			r, c := x.Commit(ctx)
-			switch kind {
-			case "success":
-				if c != "" || !r.Committed || !r.Published {
-					t.Fatal(r, c)
-				}
-			case "fsync-gap":
-				if c != ErrCommitUncertain || r.Committed || !r.Published {
-					t.Fatal(r, c)
-				}
-			default:
-				if c == "" || r.Committed || r.Published {
-					t.Fatal(r, c)
-				}
-			}
-			if kind == "exists" {
-				b, _ := os.ReadFile(root + "/published")
-				if string(b) != "foreign" {
-					t.Fatal("overwritten")
-				}
-			}
-			if _, c = x.Commit(context.Background()); c != ErrReplay {
-				t.Fatal("duplicate commit", c)
-			}
-		})
-	}
-}
-
-type writeTestACL struct{ deny bool }
-
-func (a *writeTestACL) Authorize(context.Context, Action, int) Code {
-	if a.deny {
-		return ErrDenied
-	}
-	return ""
-}
-
-type writeActionACL struct{ deny Action }
-
-func (a writeActionACL) Authorize(_ context.Context, action Action, _ int) Code {
-	if action == a.deny {
-		return ErrDenied
-	}
-	return ""
-}
-func TestWritePublishRechecksPublishACLInActor(t *testing.T) {
-	pin, root := readOnlyFixture(t)
-	w := writeWork{RootPath: root, Action: ActionWriteStream, Segments: []string{"final"}, MaxBytes: 10, Staged: true}
-	x, c := openActorWriteTransfer(context.Background(), pin, w, writeActionACL{deny: ActionPublish})
-	if c != "" {
-		t.Fatal(c)
-	}
-	defer x.Close()
-	if _, c = x.WriteChunk(context.Background(), []byte("abc")); c != "" {
-		t.Fatal(c)
-	}
-	if r, c := x.Commit(context.Background()); c != ErrDenied || r.Published {
-		t.Fatal("published without publish ACL", r, c)
-	}
-}
-
-func TestWriteDiskFullHasExactPartialReceipt(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("disposable root VM")
-	}
-	root := t.TempDir()
-	if e := unix.Mount("tmpfs", root, "tmpfs", 0, "size=64k,mode=0755"); e != nil {
-		t.Fatal(e)
-	}
-	defer unix.Unmount(root, 0)
-	pin, c := pinReadOnlyRoot(root)
-	if c != "" {
-		t.Fatal(c)
-	}
-	defer pin.Close()
-	x, c := openActorWriteTransfer(context.Background(), pin, writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"full"}, MaxBytes: MaxBoundedBytes}, fixtureReadOnlyACL{})
-	if c != "" {
-		t.Fatal(c)
-	}
-	defer x.Close()
-	var r MutationReceipt
-	for n := 0; n < 16; n++ {
-		r, c = x.WriteChunk(context.Background(), bytes.Repeat([]byte("x"), MaxChunkBytes))
-		if c != "" {
-			break
-		}
-	}
-	if c != ErrPartial || r.BytesWritten != MaxChunkBytes || r.Committed {
-		t.Fatal(r, c)
-	}
-	info, e := os.Stat(root + "/full")
-	if e != nil || info.Size() != int64(r.BytesWritten) {
-		t.Fatal(info, e)
-	}
-}
-
-func TestWriteConcurrentPublishHasOneWinnerAndNoOverwrite(t *testing.T) {
-	pin, root := readOnlyFixture(t)
-	w := writeWork{RootPath: root, Action: ActionWriteStream, Segments: []string{"winner"}, MaxBytes: 10, Staged: true}
-	first, c := openActorWriteTransfer(context.Background(), pin, w, fixtureReadOnlyACL{})
-	if c != "" {
-		t.Fatal(c)
-	}
-	defer first.Close()
-	second, c := openActorWriteTransfer(context.Background(), pin, w, fixtureReadOnlyACL{})
-	if c != "" {
-		t.Fatal(c)
-	}
-	defer second.Close()
-	first.WriteChunk(context.Background(), []byte("first"))
-	second.WriteChunk(context.Background(), []byte("second"))
-	start := make(chan struct{})
-	result := make(chan Code, 2)
-	for _, x := range []*actorFileWriter{first, second} {
-		go func(x *actorFileWriter) { <-start; _, c := x.Commit(context.Background()); result <- c }(x)
-	}
-	close(start)
-	a, b := <-result, <-result
-	if !(a == "" && b == ErrDenied || b == "" && a == ErrDenied) {
-		t.Fatal(a, b)
-	}
-	data, e := os.ReadFile(root + "/winner")
-	if e != nil || string(data) != "first" && string(data) != "second" {
-		t.Fatal(string(data), e)
-	}
-}

package/templates/native-go/backend/internal/helper/write_intent_linux.go

@@ -1,116 +0,0 @@
-package helper
-
-import (
-	"encoding/json"
-	"errors"
-	"golang.org/x/sys/unix"
-	"os"
-	"strings"
-)
-
-type fileWriteIntents struct{ repository *FileGrantRepository }
-
-func (j fileWriteIntents) Reserve(b operationBinding, actor Principal, w writeWork) Code {
-	r := j.repository
-	if r == nil {
-		return ErrUnavailable
-	}
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	if r.closed || r.poisoned || b.Inventory != r.expected || !allReferences(b.Epoch, b.OperationID, b.Nonce, b.GrantID) || b.GrantRevision == 0 || w.validate() != "" || actor.Kind != "local" || !allReferences(actor.SubjectRef, actor.InstanceRef) {
-		return ErrDenied
-	}
-	fd, e := unix.Openat(int(r.dir.Fd()), ".", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
-	if e != nil {
-		return ErrUnavailable
-	}
-	directory := os.NewFile(uintptr(fd), "write-intents")
-	limit := 4*MaxGrants + 2*MaxReplayEntries + 32
-	names, e := directory.Readdirnames(limit)
-	directory.Close()
-	if len(names) == limit {
-		return ErrBusy
-	}
-	if e != nil && len(names) == 0 {
-		return ErrUnavailable
-	}
-	count := 0
-	for _, name := range names {
-		if strings.HasPrefix(name, "write-intent-") {
-			count++
-		}
-	}
-	// Retained immutable records deliberately cap lifetime mutation attempts.
-	// No eviction, restart reset or cleanup of unknown filesystem effects.
-	if count >= MaxReplayEntries {
-		return ErrBusy
-	}
-	data, e := json.Marshal(struct {
-		Binding operationBinding `json:"binding"`
-		Actor   Principal        `json:"actor"`
-		Work    writeWork        `json:"work"`
-	}{b, actor, w})
-	if e != nil || len(data) > MaxControlBytes {
-		return ErrLimit
-	}
-	fd, e = unix.Openat(int(r.dir.Fd()), "write-intent-"+b.OperationID+".json", unix.O_WRONLY|unix.O_CREAT|unix.O_EXCL|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0600)
-	if errors.Is(e, unix.EEXIST) {
-		return ErrReplay
-	}
-	if e != nil {
-		return ErrUnavailable
-	}
-	f := os.NewFile(uintptr(fd), "write-intent")
-	defer f.Close()
-	if _, e := grantFileStat(f, 0600, 0); e != nil {
-		return ErrUnavailable
-	}
-	n, e := f.Write(data)
-	if e != nil || n != len(data) {
-		return ErrUnavailable
-	}
-	if f.Sync() != nil || f.Close() != nil || r.dir.Sync() != nil {
-		return ErrCommitUncertain
-	}
-	return ""
-}
-
-// Only final observed receipts are persisted. Missing/partial records remain
-// uncertain; their immutable intent prevents replay across a supervisor restart.
-func (j fileWriteIntents) Record(b operationBinding, m MutationReceipt, code Code) Code {
-	r := j.repository
-	if r == nil {
-		return ErrUnavailable
-	}
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	if r.closed || r.poisoned || b.Inventory != r.expected || !allReferences(b.OperationID) || code != "" && !code.Valid() {
-		return ErrDenied
-	}
-	if _, e := r.read("write-intent-"+b.OperationID+".json", 0600, MaxControlBytes); e != nil {
-		return ErrCleanupRequired
-	}
-	data, e := json.Marshal(struct {
-		Binding operationBinding `json:"binding"`
-		Receipt MutationReceipt  `json:"receipt"`
-		Code    Code             `json:"code"`
-	}{b, m, code})
-	if e != nil {
-		return ErrInvalid
-	}
-	name := "write-receipt-" + b.OperationID + ".json"
-	old, e := r.read(name, 0600, MaxControlBytes)
-	if e == nil {
-		if string(old) != string(data) {
-			return ErrReplay
-		}
-		if r.dir.Sync() != nil {
-			return ErrCommitUncertain
-		}
-		return ""
-	}
-	if !errors.Is(e, unix.ENOENT) {
-		return ErrCleanupRequired
-	}
-	return r.commit(name, data)
-}

package/templates/native-go/backend/internal/helper/write_intent_linux_test.go

@@ -1,74 +0,0 @@
-package helper
-
-import (
-	"golang.org/x/sys/unix"
-	"os"
-	"testing"
-)
-
-func TestWriteIntentSurvivesRestartAndBoundsLifetimeRetries(t *testing.T) {
-	dir, i, record := rootGrantFixture(t)
-	r := openRootGrantRepository(t, dir, i)
-	j := fileWriteIntents{r}
-	b := operationBinding{i, record.Lifecycle.Epoch, grantRef('a'), grantRef('b'), grantRef('c'), 1}
-	actor := Principal{Kind: "local", SubjectRef: grantRef('1'), InstanceRef: grantRef('2')}
-	w := writeWork{RootPath: "/trusted/root", Action: ActionCreate, Segments: []string{"file"}, MaxBytes: 10}
-	if c := j.Reserve(b, actor, w); c != "" {
-		t.Fatal(c)
-	}
-	if c := j.Reserve(b, actor, w); c != ErrReplay {
-		t.Fatal(c)
-	}
-	name := dir + "/write-intent-" + b.OperationID + ".json"
-	var st unix.Stat_t
-	if e := unix.Stat(name, &st); e != nil || st.Uid != 0 || st.Gid != 0 || st.Mode&0777 != 0600 || st.Nlink != 1 {
-		t.Fatal(st, e)
-	}
-	r.Close()
-	r = openRootGrantRepository(t, dir, i)
-	j = fileWriteIntents{r}
-	if c := j.Reserve(b, actor, w); c != ErrReplay {
-		t.Fatal("restart replay", c)
-	}
-	// Partial/crashed immutable records remain denial evidence, never removed.
-	if e := os.WriteFile(dir+"/write-intent-"+grantRef('d')+".json", []byte("partial"), 0600); e != nil {
-		t.Fatal(e)
-	}
-	b.OperationID = grantRef('d')
-	if c := j.Reserve(b, actor, w); c != ErrReplay {
-		t.Fatal(c)
-	}
-}
-
-func TestWriteFinalReceiptFsyncGapKeepsIntentAndRefusesChangedRetry(t *testing.T) {
-	dir, i, record := rootGrantFixture(t)
-	r := openRootGrantRepository(t, dir, i)
-	j := fileWriteIntents{r}
-	b := operationBinding{i, record.Lifecycle.Epoch, grantRef('a'), grantRef('b'), grantRef('c'), 1}
-	actor := Principal{Kind: "local", SubjectRef: grantRef('1'), InstanceRef: grantRef('2')}
-	w := writeWork{RootPath: "/trusted/root", Action: ActionCreate, Segments: []string{"file"}, MaxBytes: 10}
-	if c := j.Reserve(b, actor, w); c != "" {
-		t.Fatal(c)
-	}
-	m := MutationReceipt{Created: true, Published: true, BytesWritten: 10, Committed: true}
-	r.fault = func(stage string) error {
-		if stage == "after-rename" {
-			return unix.EIO
-		}
-		return nil
-	}
-	if c := j.Record(b, m, ""); c != ErrCommitUncertain {
-		t.Fatal(c)
-	}
-	r.fault = nil
-	if c := j.Record(b, m, ""); c != "" {
-		t.Fatal(c)
-	}
-	m.BytesWritten--
-	if c := j.Record(b, m, ""); c != ErrReplay {
-		t.Fatal("changed receipt", c)
-	}
-	if c := j.Reserve(b, actor, w); c != ErrReplay {
-		t.Fatal("uncertain mutation replay", c)
-	}
-}